Or it is not solved yet :).
After the update my sssd versions are:
server: 1.16.1-8
client: 1.16.1-7
Public keys get updated on the client host but ONLY after I log in to the server. Even
though I set entry_cache_timeout = 120 literally everywhere (on client and server), client
still allows to log in with ssh key after it was deleted using FreeIPA web ui.